Executive brief
The node-cli library, used for building command-line interfaces in Node.js, is vulnerable to a file overwrite flaw. An attacker could trick a user into running a command that inadvertently overwrites important system or user files. This could lead to data loss or system instability depending on which files are targeted.
Technical details
The node-cli library (versions 0.1.0 through 0.11.3) creates temporary lock and log files in the /tmp directory using predictable names based on the application name (e.g., /tmp/[app].pid). Because these files are created in a world-writable directory without sufficient validation, an attacker can create a symbolic link at the expected file path. When the application runs, it follows the link and overwrites the target file with the privileges of the user executing the CLI tool. This is classified as a path traversal/race condition issue (CWE-22, CWE-362). The vulnerability is fixed in version 1.0.0.
Affected products
- node-js-libs cli >= 0.1.0, < 1.0.0
Timeline
- 2016-03-28: disclosed: Initial report by Steve Kemp
- 2016-06-15: advisory: NPM advisory published
- 2016-06-16: other: GitHub issue #81 opened to track the flaw
- 2022-05-24: advisory: GitHub Advisory published
- 2023-12-08: other: Advisory GHSA-3mrp-qhcj-mwv5 withdrawn as a duplicate of GHSA-6cpc-mj5c-m9rq